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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


X 

THE NEW YORK TIMES COMPANY, : 

NICHOLAS CONFESSORE, and GABRIEL DANCE, 


Plaintiffs, 


COMPLAINT 

- against - : 


FEDERAL COMMUNICATIONS COMMISSION, 


Defendant. 


_ X 

Plaintiffs THE NEW YORK TIMES COMPANY, NICHOLAS CONFESSORE, and GABRIEL 
DANCE, by their undersigned attorney, allege for their Complaint: 

1. This is an action under the Freedom of Information Act (“FOIA”), 5 U.S.C. 

§ 552, to obtain an order for the production of agency records from Defendant Federal Communications 
Commission (“FCC”) in response to a FOIA request properly made by Plaintiffs (collectively, “The 
Times”). 

2. The request at issue in this litigation involves records that will shed light on the 
extent to which Russian nationals and agents of the Russian government have interfered with the agency 
notice-and-comment process about a topic of extensive public interest: the government’s decision to 
abandon “net neutrality.” Release of these records will help broaden the public’s understanding of the 
scope of Russian interference in the American democratic system. 

3. Despite the clear public importance of the requested records, the FCC has thrown 
up a series of roadblocks, preventing The Times from obtaining the documents. 

4. Repeatedly, The Times has narrowed its request in the hopes of expediting 
release of the records so it could explore whether the FCC and the American public had been the victim 
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of orchestrated campaign by the Russians to corrupt the notice-and-comment process and undermine an 
important step in the democratic process of rule-making. 

5. Repeatedly, the FCC has responded to The Times’s attempt to resolve this matter 
without litigation with protestations that the agency lacked the technical capacity to respond to the 
request, the invocation of shifting rationales for rejecting The Times’s request, and the misapplication of 
FOlA’s privacy exemption to duck the agency’s responsibilities under FOIA. 

PARTIES 

6. Plaintiff The New York Times Company publishes The New York Times 
newspaper and www.nytimes.com. The New York Times Company is headquartered in this judicial 
district at 620 Eighth Avenue, in Manhattan. 

7. Plaintiffs Nicholas Confessore and Gabriel Dance are reporters for The New York 
Times and are employees of The New York Times Company. 

8. Defendant FCC is an agency of the federal government that has possession and 
control of the records that Plaintiffs seek. 

JURISDICTION AND VENUE 

9. This Court has subject matter jurisdiction over this action, pursuant to 28 U.S.C. 

§ 1331 and 5 U.S.C. § 552(a)(4)(B). 

10. Venue is premised on the place of business of Plaintiffs and is proper in this 
district under 5 U.S.C. § 552(a)(4)(B). 

11. Plaintiffs have exhausted all administrative remedies. See 5 U.S.C. § 552(a)(4), 

(6). 

FACTS 

The FCC's Proposed Rule 

12. On May 18, 2017, the FCC adopted a notice of proposed rulemaking to the 
public titled “Restoring Internet Freedom.” The agency proposed to reclassify broadband Internet service 
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as an information service, reversing a 2015 FCC decision regulating broadband more stringently as a 
telecommunications service. 

13. At the heart of the proposed rule change was the concept of “net neutrality.” A 
recent Congressional Research Service report defines the term “net neutrality” as “the general principle^ 
that owners of the networks that compose and provide access to the internet. . . should not be able to 
discriminate against content provider access to that network.” Cong. Res. Serv. Rep. R40616, June 22, 
2018, https://fas.org/sgp/crs/misc/R40616.pdf . Opponents of the proposed rule argued that the agency’s 
proposal would eliminate net neutrality and allow internet service providers to discriminate against 
content providers. 

14. The proposed rule was assigned docket number 17-108. It opened for public 
comment on April 27, 2017 and closed on August 30, 2017. There was enormous public interest in the 
proposed rule, and around 22 million comments were submitted electronically to the FCC by the close of 
the comment period. See Pew Research Center Report, Nov. 29, 2017, https://pewrsr.ch/2AiqeFR . 

The Alleged DDoS Attacks 

15. The FCC’s mishandling of the public comment process for the proposed rule has 
been well documented. 

16. Most notably, on May 7, 2017, the FIBO Program “Last Week Tonight with John 
Oliver” aired an episode that advocated for net neutrality. The show urged viewers to submit comments 
opposing the FCC’s proposed rule. Following the airing of the show, the FCC experienced a 3,000% 
increase in the number of comments submitted, and commenters began experiencing delays and other 
issues when submitting their comments. FCC Inspector General Report, June 20, 2018, 
https://bit.lv/2Bak4fl . 

17. On May 8, 2017, the FCC’s Chief Information Officer issued a statement that the 
FCC had been the target of multiple “distributed denial of service” attacks (“DDoS”) attacks and 
attributed the problems in the comment submission process to those external attacks. Id. 
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18. A subsequent government investigation by the FCC Office of Inspector General, 
however, determined that the FCC’s statement was false. There had not been multiple DDoS attacks, 
according to the Inspector General. 

19. Rather, the Inspector General found that problems with the commenting system 
were likely due to the increase in comment traffic following the Last Week Tonight with John Oliver 
episode that aired on May 7, 2017, as well as the “high volume of traffic resulting from system design 
issues.” 

20. Members of Congress subsequently submitted a letter to the FCC Chairman 
expressing concern that the agency “allowed the public myth created by the FCC to persist and your 
misrepresentations to remain uncorrected for over a year,” and asking the FCC to respond to a written set 
of questions about the incident. House of Representatives Committee on Energy and Commerce, Letter to 
Chairman Ajit Pai, Aug. 14, 2018, https://bit.lv/2B9DwlF . 

Comments Submitted by Bots 

21. In addition to the FCC’s efforts to mislead the public about problems with the 
submission process, it has now been established that a significant percentage of the comments received by 
the FCC regarding its proposed rule were submitted by automation. 

22. A study by the Pew Research Foundation determined that 57% of the comments 
were submitted using either duplicate or temporary email accounts, and that 94% of the comments were 
submitted multiple times. As many as 75,000 comments were submitted in the same second, and these 
comments often contained the same or very similar content. Pew Research Center Report, Nov. 29, 2017, 
https://pewrsr.ch/2AiqeFR . 

23. Some of these automated messages originated from Russia. 

24. An op-ed published in March 2018 in the Washington Post by FCC 
Commissioner Jessica Rosenworcel stated that the agency received half a million comments from Russian 
email addresses. “Russians Are Hacking Our Public Commenting System, Too,” Wash. Post (Mar. 6, 
2018), https://wapo.st/2P7SXEh . 
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25. And in July 2018, a cyber-intelligence company released a report linking Russian 
email addresses cited in Special Counsel Mueller’s indictment of thirteen Russian individuals and three 
Russian companies to the emails used to submit comments on the FCC’s proposed rule. The report 
concluded that “[i]t is plausible that email addresses involved in major breaches are being harvested and 
reassigned for myriad uses.” GroupSense Report, July 24, 2014, https://bit.lv/2QE9q21 . 

The New York Times’s FOIA Request 

26. In an effort to better understand Russian influence in the FCC notice-and- 
comment system, Plaintiff Nicholas Confessore, on behalf of The New York Times Company and fellow 
reporter Plaintiff Gabriel Dance, submitted a FOIA request (the “Request”) to the FCC on June 22, 2017. 

27. The Times sought the IP addresses, timestamps, and comments, among other 
data, for all public comments regarding the FCC’s proposed rule that were submitted between April 26, 
2017 and June 7, 2017. 

28. In making the Request, The Times provided a technical description of what it 
sought. The Times requested “web server logs for comments submitted for Federal Communications 
docket No. 17-108 between 4/26/17 and 6/7/17.” The request further specified that The Times sought 
“logs for requests submitted via both to https://www.fcc.gov/ecfs/filings/ and any submissions through 
the FCC’s API (application programming interface).” For each comment, the request sought: “(1) Server 
logs for both GET and POST requests; (2) The date/time stamp of each request; (3) The full query 
including query strings; (4) The IP address of the client making the request; (5) The browser 
USERAGENT; and (6) The following headers when available: Accept, Accept-Encoding, Accept- 
Language, Connection, Host, DNT, Upgrade-Insecure-Requests, Via, X-Forwarded-For.” 

29. On July 21, 2017, the FCC denied the Request. The FCC stated that the 
information requested may be withheld in full under FOIA Exemption 6 because it “includes personably 
identifiable information and therefore cannot be released.” See 5 U.S.C. § 552. 

30. On July 25, 2017, The Times appealed the agency’s denial. 
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31. First, the Times argued that Exemption 6 does not apply to the requested records. 
See 5 U.S.C. § 552(b)(6) (shielding from disclosure “personnel and medical files and similar files the 
disclosure of which would constitute a clearly unwarranted invasion of personal privacy”). Second, The 
Times argued that even if this exemption did apply, the FCC is obligated to redact or segregate exempt 
materials rather than withhold the records in full. 

32. The Times and the FCC subsequently engaged in email and telephone 
communications in an effort to resolve this matter without litigation. 

33. In the course of these communications, the FCC raised two additional concerns. 

34. First, the agency argued that the requested records would reveal sensitive 
information about the security measures in place to protect the FCC’s notice-and-comment processes. 

35. Second, the agency argued that the request was overly burdensome. 

36. On September 22, 2017, in response to the FCC’s security concerns, The Times 
agreed to narrow its request and eliminate certain header information in an effort to ensure that the 
security measures introduced by the agency would not be revealed. 

37. Specifically, The Times agreed to “[eliminate all of the following headers: 
Accept, Accept-Encoding, Accept-Language, Connection, Host, DNT, Upgrade-Insecure-Requests, Via.” 
It requested that the FCC provide the following information for the specified time period: “X-Forwarded- 
For header, date/time stamp of each request, the fully query including query strings, the IP address of the 
client making the request, and the browser USERAGENT.” 

38. On December 15, 2017, the FCC communicated to The Times via telephone that 
this narrowed request still did not satisfy the agency’s security concerns. 

39. On December 19, 2017, the FCC and The Times had a phone call in which they 
discussed a set of parameters that would address these concerns. 

40. On December 21, 2017, The Times submitted a second proposed narrowing of its 
request in a further attempt to resolve these concerns. It sought only the comment, the originating IP 
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address, the date and time stamp, and the User-Agent header for comments submitted within the specified 
time frame. 

41. The Times stated in its letter that it “now formally submits a second proposed 
narrowing of its request in a further attempt to resolve these concerns. It seeks records for comments 
submitted through both https://www.fcc.gov/ecf /filings/ and the FCC's API (application programming 
interface) between April 26, 2017, and June 7, 2017. For each comment on docket number 17-108, it 
seeks: the comment; the originating IP address; the date and time stamp; and the UserAgent header.” The 
letter further provided: “The Times has no way of knowing the specifics of the architecture used in the 
agency’s [Electronic Comment Filing System] application, but it assumes that the agency uses a relational 
database that separates information across several tables and perhaps several databases. As such, The 
Times hopes that by limiting its request to only four data points, it has thereby limited the number of joins 
or database lookups required to fulfill the request. The Times also assumes that no manual redactions 
would be required to respond to this request, as the agency would be able to extract only the information 
requested, and the agency has already suggested that the requested information does not raise security 
concerns.” 

42. The agency never formally responded to The Times’s July 25, 2017 
administrative appeal of the agency’s denial of The Times’s FOIA request. 

43. Instead, on January 29, 2018, it submitted a supplemental response to its July 21, 
2017 denial of the initial Request. 

44. In that letter, the agency reiterated its claim that the requested records are exempt 
from disclosure under FOIA Exemption 6 because they would reveal the commenter’s IP address. 

45. It then raised two new arguments. First, it argued that the requested server logs 
may be withheld under FOIA Exemption 7(E) because they would reveal “information about how the 
Commission protects the security of [the Electronic Comment Filing System] and its other information 
assets.” Second, it argued that “it is not possible to reasonably segregate the exempt from the non-exempt 
information.” 
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46. On February 26, 2018, The Times appealed the FCC’s supplemental denial. 

47. The Times argued that neither Exemption 6 nor Exemption 7(E) permitted the 
withholding in full of the requested records, and it further argued that The Times’s narrowed request 
permitted the agency to produce only a few, limited categories of information, thereby obviating the need 
for any further redaction or segregation. 

48. The Times and the FCC spoke again by telephone on April 20, 2018. 

49. Following that conversation, The Times sent a letter to the FCC dated May 7, 
2018 with a further clarification of its Request in an effort to satisfy the agency’s concerns about privacy, 
security, and burdensomeness. 

50. The Times proposed that the agency produce across separate logs: (1) the 
originating IP addresses and timestamps, so that the agency’s security measures would not be revealed; 

(2) User-Agent headers (which reveal information such as what internet browser the individual was using) 
and timestamps; and (3) the comments, names, and timestamps submitted between the specified dates. 

51. Specifically, The Times sought to “modify[] our request to include logs from the 
FCC’s web servers handling requests to www.fcc.gov/ecfs/filings/ and the FCC’s API between April 26, 
2017 and June 7, 2017, with any non-originating IP addresses removed using a method like the one 
described above, but retaining any User-Agent headers and originating IP addresses, along with their 
respective timestamps. Additionally we’re requesting the comments, names and timestamps in ECFS 
submitted between the same dates.” 

52. On August 31, 2018, The Times sent a letter to the FCC with a fourth proposed 
narrowing of its request. 

53. In that letter, The Times eliminated the portion of the request seeking comments, 
names, and timestamps. It narrowed its request to seek only (1) originating IP addresses and timestamps, 
and (2) User-Agent headers and timestamps. 

54. Specifically, The Times proposed the following: “The Times now limits its 
request to logs from the FCC’s web servers handling requests submitted for docket No. 17-108 to 
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www.fcc.gov/ecfs/filings/ and the FCC’s API between April 26, 2017 and June 7, 2017, with any non¬ 
originating IP addresses removed using a method like the one described in the May 7,2018 letter, but 
retaining any User-Agent headers and originating IP addresses along with their respective timestamps.” 

55. By permitting the agency to produce the requested records as separate logs—one 
log for originating IP addresses and timestamps, and one log for User-Agent headers and timestamps— 
the agency’s privacy concerns would be satisfied because the originating IP addresses would not be 
li nk ed to any specific comment. 

56. This proposal would satisfy the agency’s security concerns because none of the 
security measures implemented by the agency would be revealed by producing only the originating IP 
address and User-Agent header, without any forwarding data. 

57. Finally, the proposal would resolve the agency’s concerns about burdensomeness 
because releasing the few data points requested would require the production of only a limited number of 
logs. 

58. Plaintiffs have exhausted all administrative remedies, regardless of whether the 
court construes the agency’s written communications to The Times as a formal denial of The Times’s July 
25, 2017 administrative appeal or as a failure to respond to that administrative appeal. See 5 U.S.C. § 
552(a)(4), (6). 

COUNT I 

59. Plaintiffs repeat, reallege, and reincorporate the allegations in the foregoing 
paragraphs as though fully set forth herein. 

60. Defendant FCC is subject to FOIA and must therefore release in response to a 
FOIA request any disclosable records in its possession at the time of the request and provide a lawful 
reason for withholding any materials as to which it is claiming an exemption. 

61. Plaintiffs have exhausted all administrative remedies under FOIA. See 5 U.S.C. § 

552(a)(4), (6). 
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62. The FCC has no lawful basis for declining to release the records requested by 
Plaintiffs under FOIA. 

63. Accordingly, Plaintiffs are entitled to an order compelling the FCC to produce 
records responsive to their FOIA request. 

REQUEST FOR RELIEF 

WHEREFORE, Plaintiffs respectfully request that this Court: 

64. Declare that the documents sought by their FOIA request, as described in the 
foregoing paragraphs, are public under 5 U.S.C. § 552 and must be disclosed; 

65. Order the FCC to provide the requested documents to Plaintiffs within 20 
business days of the Court’s order; 

66. Award Plaintiffs the costs of this proceeding, including reasonable attorneys’ 
fees, as expressly permitted by FOIA; and 

67. Grant Plaintiffs such other and further relief as this Court deems just and proper. 


Dated: New York, NY 

September 20, 2018 


_/s/_ 

David E. McCraw, Esq. 

Legal Department 

The New York Times Company 

620 8th Avenue 

New York, NY 10018 

phone: (212) 556-4031 

fax: (212) 556-4634 

e-mail: mccraw@nytimes.com 

Counsel for Plaintiffs 


10 





